Description (en)
0day Rubbish Research Team is publicly disclosing 2 vulnerabilities in CIRCUTOR PowerStudio SCADA WAVE 24.11.6.0
(CIRCUTOR S.A.). The research is published and a proof-of-concept is available.
Vulnerability 1: Pre-authentication SYSTEM RCE (CVSS 9.8, pre-authentication)
The native engine PwrStudio.exe runs as the Windows service CircutorPowerStudioScadaServer under NT AUTHORITY\SYSTEM.
The shared fail-open JWT library (see companion advisory) accepts a forged alg=none JWT with role=Admin. Combined with
a path-traversal write of a malicious default.xeve events configuration (containing a shellExecute action) against
PSSWidgets (port 8105) and an HTTP engine restart against PSSAdministrator (port 8089), an unauthenticated attacker
forces the engine to reload the configuration and fire XCEventActionShellExecute::Execute, which reaches CreateProcessW
with attacker-controlled arguments as SYSTEM. Under a strict default deployment where 8089 is loopback-only with no
forwarding path, the chain does not close for a pure-remote unauthenticated attacker; once 8089 is reachable (reverse
proxy, rebind, same-host, or same segment), it is a full unauthenticated remote SYSTEM RCE.
Impact: Arbitrary command execution as NT AUTHORITY\SYSTEM on the SCADA host; the attacker controls the SCADA engine,
the event configuration, and the underlying Windows host.
Advisory: https://0day-rubbish.com/blog/circutor-powerstudio-unauth-shellExecute-rce
Vulnerability 2: JWT forgery / authentication bypass (CVSS 8.6, pre-authentication)
Every .NET Core microservice registers JWT Bearer authentication via a shared extension method configured fail-open: a
custom SignatureValidator that always returns a non-null token without validating the signature,
RequireSignedTokens=false, ValidateIssuerSigningKey=false, ValidateIssuer=false, ValidateAudience=false, and an
OnAuthenticationFailed handler that silently swallows exceptions. Any attacker-crafted alg=none JWT with any role claim
is accepted as a valid authenticated identity by every microservice's AdminSecure/UserSecure policy. No credentials, no
signing key, and no user account are required; only network reachability to the target microservice port. This is an
authentication-bypass/identity-forgery primitive that compromises the product's entire authentication trust root and is
the auth-bypass primitive that enables the companion shellExecute RCE chain.
Impact: Impersonate any Admin/User role and call any protected endpoint: stop/start the SCADA engine or microservices
(DoS), push configuration, upload/download/delete files, configure external communication, and manage licenses; no
credentials required.
Advisory: https://0day-rubbish.com/blog/circutor-powerstudio-jwt-alg-none-identity-forgery
PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish
--
0day Rubbish Research Team
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Raw JSON
{
"containers": {
"cna": {
"affected": [
{
"product": "advisory",
"vendor": "Security",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "disclosure via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "0day Rubbish Research Team is publicly disclosing 2 vulnerabilities in CIRCUTOR PowerStudio SCADA WAVE 24.11.6.0 \n(CIRCUTOR S.A.). The research is published and a proof-of-concept is available.\n\nVulnerability 1: Pre-authentication SYSTEM RCE (CVSS 9.8, pre-authentication)\n\nThe native engine PwrStudio.exe runs as the Windows service CircutorPowerStudioScadaServer under NT AUTHORITY\\SYSTEM. \nThe shared fail-open JWT library (see companion advisory) accepts a forged alg=none JWT with role=Admin. Combined with \na path-traversal write of a malicious default.xeve events configuration (containing a shellExecute action) against \nPSSWidgets (port 8105) and an HTTP engine restart against PSSAdministrator (port 8089), an unauthenticated attacker \nforces the engine to reload the configuration and fire XCEventActionShellExecute::Execute, which reaches CreateProcessW \nwith attacker-controlled arguments as SYSTEM. Under a strict default deployment where 8089 is loopback-only with no \nforwarding path, the chain does not close for a pure-remote unauthenticated attacker; once 8089 is reachable (reverse \nproxy, rebind, same-host, or same segment), it is a full unauthenticated remote SYSTEM RCE.\n\nImpact: Arbitrary command execution as NT AUTHORITY\\SYSTEM on the SCADA host; the attacker controls the SCADA engine, \nthe event configuration, and the underlying Windows host.\n\nAdvisory: https://0day-rubbish.com/blog/circutor-powerstudio-unauth-shellExecute-rce\n\nVulnerability 2: JWT forgery / authentication bypass (CVSS 8.6, pre-authentication)\n\nEvery .NET Core microservice registers JWT Bearer authentication via a shared extension method configured fail-open: a \ncustom SignatureValidator that always returns a non-null token without validating the signature, \nRequireSignedTokens=false, ValidateIssuerSigningKey=false, ValidateIssuer=false, ValidateAudience=false, and an \nOnAuthenticationFailed handler that silently swallows exceptions. Any attacker-crafted alg=none JWT with any role claim \nis accepted as a valid authenticated identity by every microservice's AdminSecure/UserSecure policy. No credentials, no \nsigning key, and no user account are required; only network reachability to the target microservice port. This is an \nauthentication-bypass/identity-forgery primitive that compromises the product's entire authentication trust root and is \nthe auth-bypass primitive that enables the companion shellExecute RCE chain.\n\nImpact: Impersonate any Admin/User role and call any protected endpoint: stop/start the SCADA engine or microservices \n(DoS), push configuration, upload/download/delete files, configure external communication, and manage licenses; no \ncredentials required.\n\nAdvisory: https://0day-rubbish.com/blog/circutor-powerstudio-jwt-alg-none-identity-forgery\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T11:37:11Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/8"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/8"
},
{
"url": "https://0day-rubbish.com"
},
{
"url": "https://0day-rubbish.com/blog/circutor-powerstudio-jwt-alg-none-identity-forgery"
},
{
"url": "https://0day-rubbish.com/blog/circutor-powerstudio-unauth-shellExecute-rce"
},
{
"url": "https://github.com/Exploit-Garbage/0day-Rubbish"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/8"
],
"discovery": "EXTERNAL"
},
"title": "Security advisory: multiple vulnerabilities including JWT forgery / authentication bypass, Pre-authentication SYSTEM RCE in CIRCUTOR PowerStudio SCADA WAVE 24.11.6.0 (CIRCUTOR S.A.)",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0055",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/8",
"automated": true,
"contentSha256": "58e108022707975fd14683eff98ee10fc1c059144d9993ff6ca49b14208bced2",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/8",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-03T03:35:52Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:20:21Z",
"dateUpdated": "2026-09-11T11:37:11Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0055"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}